Load balancing VMware view with Citrix Netscaler provides a resiliant basis for your virtual desktop deployments.
Firstly why would you want to add Citrix Netscalers into a VMware view environment. Well its because neither connection servers nor security servers provide any sort of load balancing options making a VMware view installation brittle at the entry points. Without load balancing any failure of a connection or security server will translate into downtime for the environment, depending on how you carve up the view environment this may affect all or some of your user base. Either way someone is not going to be happy and this will mean either your job mobile going off at an inconvenient time or some angry faces peering through your office door.
Load balancing VMware view with Citrix Netscaler allows you to not only load balance your connection servers but also provides the high availability feature that is currently lacking within the native VMware connection and security servers.
There are other options for load balancing connection servers and yes there is a free Netscaler VPX you could use for load balancing however you should not use the free VPX for anything other than very small environments as the throughput limit of 1 Mbps could cause you issues.
UPDATE 18/06/2015: I’ve created a new blog post for load balancing security servers for external use which includes a PDF document document which includes all the below content plus a few tweaks I’ve made. Both the below instructions and the linked PDF document will work fine I’ve just tidied it up a bit.
You can find the latest version HERE
We will be using SSL_Bridging on the netscaler so the Correct SSL certificates must be present on the VMware View security servers if not you can follow this guide for more information on how to do it.
In order to load balance VMware view with Netscalers we firstly need to know a little bit about the ports that view uses to provide its virtual desktops.
Port 443 is used by view to communicate authentication requests.
Port 4172 is the actual desktop traffic so screen updates mouse and keyboard actions sound we will need both UDP and TCP traffic for this one.
For this because we are setting up multiple VIP’s to the same backend servers we will also be using persistency groups to ensure that a View request is always redirected to the same backend server no matter which VIP the traffic is hitting So without further ado lets get cracking. I’ll assume in this blog post you are familiar with the basics of a Netscaler..
1/ Create the back end server connections by clicking on Traffic Management\Load Balancing\Servers and hit ADD. Add a connection for each security server that you have in your environment making sure the IP you enter is that of the VMware View security server.
1b/ Once You’ve enter your VMware View security server details the Servers node on the Netscaler should look like this.
2/ Now we need to create the SSL bridge and View traffic services so navigate to Traffic Management\Load Balancing\Services. Click add and give the Service a name and choose SSL_bridge from the protocol. With SSL bridging the port will be pre-populated for you. Then choose the First security server in your Server list.
From the monitors tab choose a service monitor you think appropriate which for me is both tcp and https. This will continually ensure that both a tcp connection and a valid https connection is possible with the backend server and if one of those fails traffic will be not be routed to the failed service.
Once you have all that in place hit Ok to create the service then repeat the steps for the other security servers you have. If you have quite a few security servers to configure the Netscaler with I would use service groups instead but in this case services will do us just fine.
Now we have the SSL_bridge configured its time to create the services for the PCOIP traffic. For that the steps are very similar. Hit Add on the services menu to create a new service. Give it a sensible name and choose your first security server from the drop down server list.
From the Protocol menu choose UDP and manually enter the PCOIP port of 4172. Again you need to add a monitor so that the Netscaler can poll the server to ensure the service is up. For me ping is adquate and then hit OK to create the service. Repeat the steps again for all the required security servers.
Now you need to create the last service for the PCOIP TCP traffic. The steps are the same as above so I won’t repeat myself but heres a screenshot of what the TCP service should look like.
Penultimately we need to create the virtual IP’s that the your VMware View clients will actually use to connect to and receive their beautifully crafted virtual desktops. To create those click on Traffic Management\Load Balancing\Virtual Servers and hit Add.
Again give the Virtual Server a sensible name and also you need to give it an IP address. This IP address will be the same across all the Virtual Servers we create and should be the IP that is resolvable by a DNS name (something like View.vhorizon.co.uk for example).
Choose the first protocol that we created SSL_Bridge and from the services tab hit Add and add each security server that we have configured previously (if you have a lot of security servers and have used service groups then you’ll need to do this on the service group tab). Because we are using persistency groups we do not need to specify a persistence method here. Click Ok and your done for this protocol.
We need to create 2 more virtual servers for the TCP and UDP PCOIP traffic. Again hit Add and configure each virtual server to look like the screen shots below.
UDP Virtual Server
TCP Virtual Server
Once you have the Virtual Servers configured your Virtual Server page should look like this.
Finally we configure persistency groups for our virtual servers. This ensures that the server that is load balanced too and replies to the VMware View client is the same one that receives traffic to it from the View client on the other ports/Virtual Servers.
To do this navigate to Traffic Management/Load Balancing/Persistency Groups and again hit Add.
Again give the Group a name and choose SourceIP as the persistence. You can then config the net mask if you want the persistence to apply to a group of machines in a subnet or more typically keep it at the default which is per client. Click Add under the Virtual Server Name and add the 3 Virtual Servers you have already created. Click OK and you are done.
If you have configured all the components correctly then you should now be able to launch the VMware View client and open a desktop. Using the DNS name that resolves to the Virtual Server IP on the Netscaler.
Heres a brief bit of added extra on NetScaler monitors to provide a more fault tolerant VMware View platform. The big issue with VMware View is its reliance on one to one relationships between a security server and a connection server, and the issue arrives when your security server remains up but the connection server is down. Without creating custom monitors within the NetScaler config the Netscaler will be unaware of the failure because the standard monitor will still show the security server as being up and will continue to try and send requests to the security server with the failed connection server.
To resolve the issue click on the monitors node and click Add. Then configure a monitor per connection server with the desired settings remembering to set the Destination IP address to be that of the connection server, for me a TCP monitor would cover most situations.
Once enough monitors have been created bind each one to the services you have created. For example if you have 3 separate services for a security server (SS01) PCOIP, UDP and TCP and the security server is linked to CS01 bind the TCP monitor for CS01 to all 3 services for SS01. This will have the effect of monitoring the general health of the associated connection server as well as the security server itself. If the connection server goes down then the SS01 services will be marked as down and the NetScaler will load balance to the remaining security servers.
Below is a brief video showing the steps I took above and finishing off by using VMware View client to a XP desktop.
Author: Dale Scriven
Subscribe to vhorizon
DisclaimerThis blog and any other post made by me on the internet is representative of my views only, they are not the views of my past/current/future employers.